Kilo Code CLI vs Paperclip

Kilo Code CLI

Shell commands ask before running by default, and an optional operating-system sandbox blocks writes outside the workspace and outbound network. Telemetry to PostHog is on by default and the sandbox is off, so an unattended kilo run --auto approves everything not denied unless both are configured first.

Paperclip

Board approvals, budgets with a hard stop and an activity log sit above whichever harnesses do the work, and eleven stable versions shipped in 90 days. The Claude Code and Codex adapters skip permission prompts and the sandbox by default, and twelve security advisories, five of them critical, have been published since April 2026.

Kilo Code CLI

1. Set sandbox.enabled to true in the global kilo.jsonc before kilo run --auto. --auto approves every permission request not explicitly denied
2. Set experimental.openTelemetry to false, or KILO_TELEMETRY_LEVEL to a value other than all, to stop telemetry
3. Add needed hosts to sandbox.allowed_hosts in global config. MCP tool calls are unavailable while network restriction is on
4. Without --auto a non-interactive run rejects every permission prompt and exits 1
5. Put provider keys in global config or the environment. {env:VAR} in a project kilo.json is ignored

Paperclip

1. Set PAPERCLIP_TELEMETRY_DISABLED=1 or DO_NOT_TRACK=1 before the first start. Telemetry is on by default
2. Set dangerouslySkipPermissions and dangerouslyBypassApprovalsAndSandbox to false on agents that read untrusted input, or run them in a sandbox provider
3. Install with Node.js 24.11 or newer, and install and sign in to each harness CLI on the host first. Paperclip assumes they are there
4. Use --bind lan or --bind tailnet at onboarding for anything beyond one machine. The default local_trusted mode treats every request as the board admin
5. Treat 409 on task checkout as owned by another agent and pick different work. The API docs say not to retry